Address: 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA
E-mail: [email protected]
COTA CRM is a product of PINHAN GROUP LLC. pinhangroup.com
Purpose and scope. This notice is issued under Art. 10 of Turkish Law No. 6698 on the Protection of Personal Data (the "Law") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Disclosure Obligation, by the data controller PINHAN GROUP LLC (the "Company"). It applies to individuals who visit the website at cotacrm.com and its subdomains, request a demo, complete the contact or data-request forms, and to individuals involved in the account, billing and support processes of businesses that purchase COTA CRM.
1. Identity of the data controller
Data controller: PINHAN GROUP LLC (a limited liability company formed in the State of Delaware, USA). Address: 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA. E-mail: [email protected]. COTA CRM is a product of the Company.
Turkey representative: Representative details will be published on this page once appointed; until then, all requests may be sent to [email protected].
VERBIS. As a data controller established abroad, the Company assesses whether it falls within the obligation to register with the Data Controllers' Registry and appoint a representative under the Board's decisions; if it is subject to that obligation, the registry and representative details will be published in this notice upon registration and appointment.
2. Categories of personal data processed
| Category | Data | Channel |
|---|---|---|
| Identity | First and last name | Demo, contact and data-request forms; account creation |
| Contact | E-mail address, phone number | Same channels |
| Professional / customer transaction | Sector, plan of interest, message content, request type, referral code; role and branch in a Customer account | Forms; account management |
| Transaction security | IP address, browser/device information (user agent), request time, session and CSRF cookies, rate-limit counters, login one-time code (stored hashed, valid 10 minutes), activity and audit logs, push notification tokens | Automatic; service use |
| Account, invoice and support | Invoicing details, payment and balance records, support correspondence | Customer; service use |
| Consent and proof records | Cookie choice (category, text version, time), timestamps of notice acknowledgement and marketing consent | Cookie banner; form checkboxes |
| Visitor analytics (only with explicit consent) | Page path and time, referring domain, campaign parameters, device type, browser and operating system family, screen size, language, time zone, random visitor ID (cota_vid), daily-salted one-way (SHA-256) hash of the IP address; raw IP is not stored | Analytics cookie (first-party) |
The Company does not collect special categories of personal data (Law Art. 6) through the website; please do not enter such data in forms. If entered, it is not processed beyond what the request requires and is deleted as soon as possible.
3. Purposes and legal grounds
| Purpose | Legal ground |
|---|---|
| Receiving and answering demo requests; opening accounts, providing the service, billing and support | Art. 5/2-c — necessary for the conclusion or performance of a contract |
| Answering questions and requests sent through the contact form | Art. 5/2-f — legitimate interests of the controller, provided fundamental rights and freedoms of the data subject are not harmed |
| Secure and uninterrupted operation of the website and service; preventing forged requests, abuse and attacks | Art. 5/2-f — legitimate interests; security obligation under Art. 12 |
| Fulfilling obligations under invoicing, tax and commercial law | Art. 5/2-a and 5/2-ç — expressly provided for by law; legal obligation |
| Recording cookie choices and consents as proof; defence in disputes | Art. 5/2-ç, 5/2-e — legal obligation; establishment, exercise or protection of a right |
| Measuring visits and improving content and experience (analytics cookie) | Art. 5/1 — explicit consent (in line with the Board's Cookie Guide). If consent is not given, this data is not collected. See the Explicit Consent Statement |
| Sending commercial electronic messages | Art. 5/1 — explicit consent; separate consent under Law No. 6563 and the Regulation on Commercial Communications; IYS registration |
| Receiving and verifying data-subject requests and responding to them | Art. 5/2-ç — legal obligation (Law Art. 13) |
| Meeting lawful requests of competent public authorities | Art. 5/2-a, 5/2-ç |
4. Transfers of personal data
Domestic. To the extent required by the service and under written data processing terms, data may be transferred to service providers established in Turkey, such as NetGsm İletişim ve Bilgi Teknolojileri A.Ş. for SMS delivery (or İleti Merkezi where the Customer chooses it), and, on a lawful request, to competent public authorities and courts.
Abroad. Your personal data is hosted in a data centre in Germany (European Union); the Company, as controller, is established in the United States and accesses the data from there. US-based subprocessors are also used for e-mail delivery, bot protection and encrypted backups, push notifications, WhatsApp (where the Customer connects it) and the AI assistant. The current list is on the Subprocessors page. These transfers rely on the standard contract mechanism published by the Board under Art. 9 of the Law (as amended by Law No. 7499, in force 1 June 2024) or other safeguards in Art. 9; the standard contract is signed unchanged and notified to the Board within the statutory period (five business days after signing). Explicit consent is not used as the legal ground for ordinary cross-border transfers. Analytics data is stored in Germany and processed by the Company (US-based); this information forms part of the disclosure relating to your consent.
5. Method of collection
Personal data is collected from you directly through website forms, during account creation and service use, and automatically through strictly necessary cookies and server access logs. Analytics cookies are placed only if you give explicit consent in the cookie banner. You may withdraw consent at any time via Cookie settings; withdrawal has effect for the future.
6. Retention periods
| Data | Period |
|---|---|
| Demo and contact requests | Up to 2 years after last contact |
| Server access (security) logs | As long as needed for security; up to 2 years |
| Cookie choice | 180 days (cookie); consent proof record for the statutory limitation period |
| Visitor analytics | 180 days; automatically deleted afterwards |
| Commercial message consent and opt-out records | 3 years from withdrawal of consent |
| Data-subject requests | As long as needed to demonstrate compliance and during the statutory limitation period |
| Invoice and accounting records | Period required by tax and commercial law |
| Account and user data | For the term of the agreement; deleted afterwards, subject to the statutory retention periods above |
At the end of the period, data is deleted, destroyed or anonymised in accordance with the Regulation on Deletion, Destruction or Anonymisation of Personal Data.
7. Data security
The Company takes technical and organisational measures to ensure an appropriate level of security under Art. 12 of the Law: TLS encryption in transit, a separate database per Customer, role- and branch-based access control, e-mail one-time-code login, encryption of secrets, audit logs, encrypted off-site backups and no storage of raw IP addresses in analytics. In the event of a breach, the Board is notified within 72 hours of becoming aware and affected data subjects within a reasonable time, under Art. 12/5.
8. Rights of the data subject (Law Art. 11)
- To learn whether your personal data is processed;
- To request information if it has been processed;
- To learn the purpose of processing and whether it is used in line with that purpose;
- To know the third parties to whom it is transferred, domestically or abroad;
- To request correction if it is incomplete or inaccurate;
- To request deletion or destruction under the conditions in Art. 7;
- To request that actions under items (5) and (6) be notified to third parties to whom the data was transferred;
- To object to an outcome against you resulting from analysis exclusively by automated systems;
- To claim compensation for damage arising from unlawful processing.
9. How to apply
You may submit requests, in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, (i) through the Data Subject Request Form, (ii) by e-mail to [email protected], or (iii) in writing to 501 Silverside Road, Suite #105 - 5653, Wilmington, DE 19809, USA. The application must include your first and last name, signature (for written applications), Turkish ID number (for foreigners, nationality and passport or ID number if any), residence or workplace address for notification, e-mail/phone number if any, and the subject of the request. The Company may request additional information to verify that the application is yours.
Applications are concluded free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request; if the action requires additional cost, the fee in the Board's tariff may be charged. If your application is rejected, the answer is insufficient or no answer is given in time, you may complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of the application date (Law Art. 14).
10. Changes
The Company updates this notice as legislation and processing activities change. The current version is published at this address; the date at the top shows the latest change. Where changes affect the scope of cookies, the cookie banner is shown again and new consent is requested.
